This release adds 5 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
Summary
AI summaryAdd session and forwarding channel limits, validation flags for config files, braced macro support, broader IPv6 rate limiting, and hardened SSH key exchange selection.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Hardens SSH key exchange algorithm selection to mitigate weak algorithms Hardens SSH key exchange algorithm selection to mitigate weak algorithms Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Medium |
Adds session and forwarding channel limits via `-sessions-max` and `-forwards-max` flags Adds session and forwarding channel limits via `-sessions-max` and `-forwards-max` flags Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Medium |
Adds `-validate-authorized-keys` and `-validate-known-hosts` flags to validate config files Adds `-validate-authorized-keys` and `-validate-known-hosts` flags to validate config files Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Medium |
Adds support for braced `{{NAME}}` macros in templates Adds support for braced `{{NAME}}` macros in templates Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Dependency | Low |
Bumps golang runtime from 1.26.3-trixie to 1.26.4-trixie in Docker images Bumps golang runtime from 1.26.3-trixie to 1.26.4-trixie in Docker images Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Dependency | Low |
Bumps github.com/google/go-tpm-tools from 0.4.8 to 0.4.9 (minor patch) Bumps github.com/google/go-tpm-tools from 0.4.8 to 0.4.9 (minor patch) Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Dependency | Low |
Bumps github/codeql-action from 4.36.1 to 4.36.2 in GitHub Actions workflow Bumps github/codeql-action from 4.36.1 to 4.36.2 in GitHub Actions workflow Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Performance | Low |
Escalates IPv6 rate limiting to broader prefixes for better traffic control Escalates IPv6 rate limiting to broader prefixes for better traffic control Source: llm_adapter@2026-06-06 Confidence: high |
— |
Full changelog
What's Changed
- Add session and forwarding channel limits (
-sessions-max,-forwards-max) - Add
-validate-authorized-keysand-validate-known-hostsflags to check config files - Add support for braced (
{{NAME}}) macros - Escalate IPv6 rate limiting to broader prefixes
- Harden SSH key exchange algorithm selection
Dependencies
- Bump the github-actions-all group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/73
- Bump golang from 1.26.3-trixie to 1.26.4-trixie in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/72
- Bump github.com/google/go-tpm-tools from 0.4.8 to 0.4.9 in the gomod-minor-patch group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/74
- Bump github/codeql-action from 4.36.1 to 4.36.2 in the github-actions-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/75
Full Changelog: https://github.com/hectorm/cardea/compare/v1.8.0...v1.9.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Cardea
SSH bastion server with access control, session recording, and optional TPM-backed key protection. `EUPL-1.2` `Go/Docker`
Related context
Related tools
Beta — feedback welcome: [email protected]